azure WCF and mutual certificate auth - how?

I have got quite a long way with this. I want a WCF service hosted in azure that uses client certificate authentication.

Everything works with the client cert requirement turned off and server cert on; ie

   <transport clientCredentialType="None" />

but when I change to

   <transport clientCredentialType="Certificate" />

I get

The SSL settings for the service 'SslRequireCert'开发者_JS百科 does not match those of the IIS 'None'.

This seems to suggest that I need to change my IIS configuration. But I am running inside azure emulator, not IIS.

I tried adding

 <system.webServer>
      <security>
         <access sslFlags="ssl">
      </security>
   </system.webServer>

but the web server did not like that at all; says this is a locked configuration option

All help gratefully received

answer: unlock the iis config file with appcmd

unlock the iis config file with appcmd